CVE-2026-19121

Summary

IBM API Connect versions 12.1.0.0 through 12.1.1.2 suffer from improper authorization where an authenticated user can bypass tenant isolation by accessing resources belonging to another tenant due to insufficient verification of tenant context against the authenticated user's identity. This allows unauthorized access to sensitive data and operations across tenants.

Exploitability

Exploitation requires valid authentication and knowledge of another tenant's resource identifiers; no public exploit exists, but the low attack complexity (AV:N, AC:L) suggests it is feasible for a privileged insider or compromised account.

Blast radius

Successful exploitation enables cross-tenant data access and modification, potentially leading to full compromise of tenant confidentiality and integrity within the same API Connect deployment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM API Connect 12.1.1.3 or later, which includes fixes for improper authorization in the tenant context validation logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.